Understanding Get-Process output in PowerShell

PowerShell has a nice cmdlet caled Get-Process that allows you to get information about running processes. This command has many options, but even with it's defaults, it provides a good overview of either all processes on the system, or information about a specific process.

For example, to check Visual Studio's processes (devenv.exe), run the following command:

Get-Process -Name devenv

The output may look like this in PowerShell 7 (the older Windows-only PowerShell 5 has slightly different output):

 NPM(K)    PM(M)      WS(M)     CPU(s)      Id  SI ProcessName
 ------    -----      -----     ------      --  -- -----------
  12403 1 363,06   1 423,88   5 414,27   25256   1 devenv
   7266   971,35   1 075,73   2 711,56   36392   1 devenv
    592 2 505,54   2 838,43   9 720,89   87992   1 devenv

Each row is one process instance. In this example, there are three running devenv processes.

The columns mean:

• NPM(K): non-paged memory used by the process, in kilobytes
• PM(M): pageable memory used by the process, in megabytes
• WS(M): working set size, in megabytes
• CPU(s): total processor time used by the process, in seconds
• Id: process ID
• SI: session ID
• ProcessName: process name.

The most useful columns in normal troubleshooting are usually Id, CPU(s), and WS(M).

The Id value is the process ID. Use it when you need to inspect or stop one specific process.

Stop-Process -Id 25256

The CPU(s) value is cumulative CPU time. It is not the current CPU percentage. A high value usually means the process has used a lot of CPU since it started.

The WS(M) value is the working set. This is memory that is currently resident in physical memory for the process.

Tip: do not directly compare WS(M) with the default Memory column in Windows Task Manager. Task Manager often shows Memory (active private working set), which is not the same value.

This is why PowerShell and Task Manager may appear to disagree about memory usage for the same process.

If you want to see more process properties, pipe the result to Select-Object:

Get-Process -Name devenv |
    Select-Object Id,
                  ProcessName,
                  CPU,
                  WorkingSet64,
                  PrivateMemorySize64,
                  PagedMemorySize64

The 64 suffix properties return byte values, which are better for calculations.

For example, show working set and private memory in megabytes:

Get-Process -Name devenv |
    Select-Object Id,
                  ProcessName,
                  @{ Name = "WorkingSetMB"; Expression = { [math]::Round($_.WorkingSet64 / 1MB, 2) } },
                  @{ Name = "PrivateMB"; Expression = { [math]::Round($_.PrivateMemorySize64 / 1MB, 2) } }

Handy: use PowerShell when you want scriptable process data. Use Task Manager when you want an interactive view. Just remember that the column names may not represent the same memory metric.

For quick process checks, this is often enough:

Get-Process -Name devenv |
    Sort-Object CPU -Descending

Or for memory:

Get-Process -Name devenv |
    Sort-Object WorkingSet64 -Descending